VRChat OSCSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
VRChat MCP OSC provides a bridge between AI assistants and VRChat using the Model Context Protocol (MCP), enabling AI-driven avatar control and interactions in virtual reality environments.
Overview
By leveraging OSC (Open Sound Control) to communicate with VRChat, VRChat MCP OSC allows AI assistants such as Claude to:
- Control avatar parameters and expressions
- Send messages in VRChat
- Respond to various VR events
And more—all through the high-level API provided by the Model Context Protocol.
Key Features
- Avatar Control: Manipulate avatar parameters and expressions
- Movement Control: Direct avatar movement and orientation
- Communication: Send messages through VRChat's chatbox
- Menu Access: Toggle VRChat menu and interface elements
- Avatar Information: Query avatar properties and parameters
- Seamless VRChat Integration: Automatic detection of avatar configurations
System Requirements
- Node.js 18 or higher
- VRChat with OSC enabled
- Claude Desktop (with MCP support)
Using with Claude Desktop
Clone and npm link
git clone https://github.com/Krekun/vrchat-mcp-osc cd vrchat-mcp-osc npm link
Configure Claude Desktop
Configure Claude Desktop by editing the claude_desktop_config.json file:
{
"mcpServers": {
"vrchat-mcp-osc": {
"command": "npx",
"args": [
"vrchat-mcp-osc"
]
}
}
}Command Line Options
The server supports various command-line arguments for customization:
# Claude Desktop configuration
{
"mcpServers": {
"vrchat-mcp-osc": {
"command": "npx",
"args": [
"vrchat-mcp-osc",
"--websocket-port", "8765",
"--websocket-host", "localhost",
"--osc-send-port", "9000",
"--osc-send-ip", "127.0.0.1",
"--osc-receive-port", "9001",
"--osc-receive-ip", "127.0.0.1",
"--debug"
]
}
}
}Availabl
0d4c3ac56661OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add utils -- npx -y @vrchat-mcp-osc/[email protected]
{
"mcpServers": {
"utils": {
"command": "npx",
"args": [
"-y",
"@vrchat-mcp-osc/[email protected]"
]
}
}
}Exposed tools (12)
7 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_avatar_list | read | Get a list of available avatars. |
get_avatar_name | read | Get the name of the current avatar. |
get_avatar_parameters | read | Get a list of parameters available on the current avatar. |
jump | read | Make the avatar jump. |
look_direction | read | Turn to look in a specific direction. |
menu | read | Toggle Menu. |
move_avatar | write | Move the avatar in a specific direction. |
send_message | write | Send a message to the VRChat chatbox. |
set_avatar | write | Change to a specific avatar. |
set_avatar_parameter | write | Set a parameter on the current avatar. |
set_emote_parameter | write | Set VRCEmote on the current avatar. |
voice | read | Toggle voice |
Trust audit
SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
path.resolve(__dirname, '../../relay-server/dist/index.js'),
path.resolve(process.cwd(), '../../node_modules/@vrchat-mcp-osc/relay-server/dist/index.js')
pnpm, typescript
@modelcontextprotocol/sdk, node-osc, uuid, ws, zod, @types/node, @types/node-osc, @types/uuid
node-osc, ws, @types/node, @types/node-osc, @types/ws, eslint, rimraf, ts-node
@types/node, eslint, rimraf, typescript
winston, @types/node, eslint, rimraf, typescript
Gates applied: no_behavioural_pass, no_license.
0d4c3ac56661full audit observations/trust-audit/mcp-server/krekun__vrchat-osc.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 0d4c3ac56661 | SAFE | B | 87 | first audit |
Questions
What tools does VRChat OSC expose?
12 in total: 7 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is VRChat OSC safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does VRChat OSC need?
No credential environment variables were found in its source, so it appears to need none.
How does VRChat OSC run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @vrchat-mcp-osc/utils at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (0d4c3ac56661), read on 2026-10-09. The repository is watched and re-audited when it changes.